triage
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from issue trackers, such as issue bodies, comments, and pull request descriptions. This untrusted input is used to generate summaries and recommendations. Because the instructions lack explicit boundary markers or sanitization logic when handling this data, a malicious reporter could attempt to influence the agent's behavior via embedded instructions.
- Ingestion points: Reading issue/PR content in
SKILL.md(Step 1: Gather context). - Boundary markers: None defined for the interpolation of issue data.
- Capability inventory: Includes filesystem writes (
.out-of-scope/), posting tracker comments, and command execution. - Sanitization: No validation or filtering is specified.
- [COMMAND_EXECUTION]: The skill is instructed to 'run the relevant tests or commands' to verify Pull Requests. This involves executing code provided by external contributors. While the workflow includes a 'Wait for direction' step before verification, the capability to run untrusted code remains a significant security surface.
- [REMOTE_CODE_EXECUTION]: The verification process for external PRs requires checking out and executing code from remote forks. This constitutes remote code execution of untrusted logic, which is an inherent risk in automated PR triage workflows.
Audit Metadata